-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| xml-crypto | npm | >= 4.0.0, < 6.0.0 | 6.0.0 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from two key behaviors: 1) The default getCertFromKeyInfo implementation (added in #301) blindly extracts certificates from untrusted XML <KeyInfo> elements. 2) The validation logic (visible in pre-fix code) prioritized these extracted certificates over explicitly configured publicCert. The fix in #445 disabled the default certificate extraction by setting getCertFromKeyInfo to noop, forcing use of publicCert unless explicitly overridden. The commit diff shows critical changes to the certificate selection logic in signed-xml.ts and test updates requiring explicit opt-in for KeyInfo certificate extraction.
Name of the signingCert was changed later (but prior to 4.0.0 release) to publicCert:
Issue was fixed to 6.0.0 by disabling implicit usage of default getCertFromKeyInfo implementation:
Possible workarounds for versions 4.x and 5.x:
getCertFromKeyInfo against trusted certificates before accepting the results of the validation.xml-crypto's getCertFromKeyInfo to () => undefined forcing xml-crypto to use an explicitly configured publicCert or privateKey for signature verification.https://github.com/node-saml/xml-crypto/discussions/399
An untrusted certificate can be used to pass a malicious XML payload through an improperly configured installation of xml-crypto.
Ongoing coverage of React2Shell